Know what is open on
your site before anyone else does.

Yes. Non-invasive by design: normal HTTP(S) requests and plain TCP connects only. No exploitation, no payloads, no DoS. A web audit sends roughly 15-25 requests total, and redirects to other hosts are observed but never followed. Only scan assets you own or have written permission to test.

If you paste one, it lives in server memory for the duration of a single shallow clone, is never logged, never stored, and is scrubbed from every byte we send back. When the audit ends it is gone. Open repos need no token at all.

Up to eight source files (a bounded sample, code files only) are sent to the AI analyst so it can reason about your code. Before anything leaves the server, secret-shaped strings are redacted, and files flagged for secrets are excluded from sampling entirely. Nothing is stored after the report is delivered.

Yes. Before a report ships, every finding goes through a second pass. High-risk website checks (headers, TLS-adjacent probes) are re-confirmed with an independent second request against your live target. Every finding is then judged by a skeptical AI verifier and labeled ✓ verified, ~ heuristic or ? manual check, with a one-line reason.

Every report ends with a “Fix it with your dev agent” block: a ready-to-paste prompt with the full issue list in priority order, concrete fixes, working rules (rotate leaked credentials, close root causes, keep changes behavior-compatible) and acceptance criteria. Copy it into Cursor, Claude Code, Codex or Copilot, let it patch, then re-run the same audit to confirm.

Every report ends with a compare token, a short checksummed string encoding which checks failed and how severely. Paste it on your next scan of the same target and the report opens with a comparison: what got fixed, what is still open, what is new, and whether your score moved. Nothing is stored on our side; if you lose the token, the history is gone.

Website audits open with A+ to F grades — overall, headers, TLS, exposure, ports and email. They are pure math on the verified findings: a critical finding costs 34 points, a high one 22, a medium 12, a low 6. A+ means nothing worth flagging in that layer; F means an attacker’s checklist is wide open. Fix the findings and the grades move on your next scan — the compare token proves it.

Press Share report on any finished website audit and you get a read-only link to that exact report — grades, findings, fix prompt. The link works for 72 hours, then the snapshot deletes itself automatically. A report is only ever stored when you press Share; share nothing and nothing is kept. It is the fastest way to hand your developer, your boss or a client the full picture.

Because anyone can send email that looks like it comes from your domain unless three public DNS records say otherwise: SPF (which servers may send), DKIM (cryptographic signing) and DMARC (what receivers should do with forgeries). The website audit reads those records — the same ones every mail server reads — grades them and hands you the exact records to publish. Most domains fail this check without knowing it.

No. Every scanner process runs as a dedicated unprivileged account with no shell access, no read access to application files, configuration or data, and a firewall rule set that refuses all traffic to private networks, the host itself and cloud-metadata addresses. Only public internet destinations are reachable from the sandbox.

As little as the product can run on. Your report is assembled in server memory, delivered to your browser and then gone: no findings, no report content, no tokens, no contact data. What is kept is a minimal ops record per scan (time, type, target host, outcome, severity counts, duration, how it was paid) for capacity planning and abuse prevention.

The free tier is 3 audits per 24 hours; that keeps each scan deep, fast and unmolested for everyone. For teams, CI pipelines and client work, order additional scan tokens by emailing sales@xshredo.com with your expected volume and we will size it to your workflow. Some tokens are limited to specific kinds (a website-only token covers website audits but not the others).